{"id":"GO-2022-0588","summary":"Cross-site scripting via leaked style elements in github.com/microcosm-cc/bluemonday","details":"The bluemonday HTML sanitizer can leak the contents of a \"style\" element into HTML output, potentially causing XSS vulnerabilities.\n\nThe default bluemonday sanitization policies are not vulnerable. Only user-defined policies allowing \"select\", \"style\", and \"option\" elements are affected.\n\nPermitting the \"style\" element in policies is hazardous, because bluemonday does not contain a CSS sanitizer. Newer versions of bluemonday suppress \"style\" and \"script\" elements even when allowed by a policy unless the policy explicitly requests unsafe processing.","aliases":["CVE-2021-42576","GHSA-x95h-979x-cf3j","PYSEC-2021-849"],"modified":"2024-05-20T16:03:47Z","published":"2022-08-15T18:02:24Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2022-0588"},"references":[{"type":"FIX","url":"https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4"},{"type":"WEB","url":"https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/"}],"affected":[{"package":{"name":"github.com/microcosm-cc/bluemonday","ecosystem":"Go","purl":"pkg:golang/github.com/microcosm-cc/bluemonday"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.16"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/microcosm-cc/bluemonday","symbols":["Policy.AllowElements","Policy.AllowElementsMatching","Policy.AllowLists","Policy.AllowTables","UGCPolicy"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-0588.json"}}],"schema_version":"1.7.3"}